DIGITAL SURVEILLANCE Why the Snoopers’ Charter is the wrong approach: A call for targeted and accountable investigatory powers About Open Rights Group Contents Open Rights Group (ORG) was formed in 2005 by a group of technology experts and activists to campaign for human rights and civil liberties in the digital age. ORG is funded by over 1,500 people, each contributing small regular amounts, and a number of grant giving Introduction: 3 organisations such as Joseph Rowntree Reform Trust, Sigrid Rausing Surveillance law is not a ‘them and us’ problem Trust and Open Society Foundation. Chapter 1 7 The history of state surveillance Duncan Campbell Report Editors Jim Killock Since joining Open Rights Group in January Chapter 2 17 Executive Director 2009, Jim has led campaigns against three Regulating surveillance, respecting private life strikes and the Digital Economy Act, the Angela Patrick company Phorm and its plans to snoop on UK Internet users, and against pervasive Chapter 3 31 government Internet surveillance. He is Current and future surveillance technology working on data protection and privacy issues, as well as helping ORG to grow in size Richard Clayton and breadth. He was named as one of the 50 most influential people on IP issues by Chapter 4 39 Managing IP in 2012. In the same year ORG Why digital technology poses a problem for won Liberty’s Human Rights Campaigner of surveillance law Peter Sommer Year award alongside 38 Degrees, for work on issues from copyright to the Snooper’s Chapter 5 Charter. Data preservation instead of data retention Peter Bradwell Peter joined ORG in January 2011, initially Caspar Bowden 47 Policy Director working on copyright reform. Before this he worked at the think tank Demos for CDB and human rights: an international perspective four years, where he focused primarily Simone Halink on technology policy and the relationship 50 between technology and society. Peter has Inflated scope and increased harms of existing authored a number of reports, including our reports on mobile Internet censorship surveillance law Joss Wright 52 in the UK, the availability of digital film services and consultation responses on Freedom offline, surveillance online the Communications Data Bill and data – an unsustainable conflict Nick Pickles 54 protection legislation in Europe. Citizens not suspects: surveillance in a digital age Ben Zevenbergen Ben joined the Open Rights Group on a part-time basis, to help with campaigns Rachel Robinson 56 Researcher and research, alongside his PhD/DPhil on Internet science at the Oxford Internet The future of surveillance laws Institute. He has worked on legal, political Peter Sommer 58 and policy aspects of the information society for several years. Most recently he was a Communications data: getting there from here policy advisor to an MEP in the European Sam Smith 60 Parliament, working on Europe’s Digital Agenda. Previously Ben worked as an ICT/ IP lawyer and policy consultant in the Conclusion and recommendations 64 Netherlands. Ben holds a degree in law, and Another surveillance law is possible 2 a masters in information law. Introduction: Surveillance law is not a ‘them and us’ problem “Anybody who is against this bill is putting politics before people’s lives.... It’s a question of whose side you’re on.” Rt Hon Theresa May MP, December 20121 This statement from the Home Secretary, made in December 2012, tells us a lot about the approach that her Department has taken to the development of surveillance policy. It also helps to explain why the draft Communications Data Bill (CDB) poses such a disproportionate risk to our privacy. The Home Office have often framed the debate over the CDB in ‘them and us’ terms. But if this really does just come down to picking sides, it is odd that both of the Parliamentary committees tasked with examining the draft Bill – the Joint Committee on the draft Communications Data Bill and the Intelligence and Security Committee – reached such critical conclusions2. Both committees noticed that there are more questions to ask when considering surveillance law than whether you are on the side of criminals. They include what current capability gaps there are, what new information will be gathered and from whom, how intrusive the information is, how any technological solutions will work, and what authorisations for access to data should be required. But at no time have the Government attempted to seriously address those questions openly. The Home Office instead wrote the Communications Data Bill in isolation. 3 In its report, the Joint Committee examining the CDB lamented that there was no consultation, no proper definition of the problem and no adequate explanation of, – or evidence for – the Home Office’s proposed solution. The Bill appeared built to withstand public scrutiny, rather than be informed by it. The result is, perhaps unsurprisingly, a draft Bill that the Committee concluded pays “insufficient attention to the duty to respect the right to privacy, and goes further than it need or should.” The CDB would lead to the collection of far too much information, about far too many people – effectively everyone – and would allow far too many people access to it. This report This situation could have been avoided. This report demonstrates that surveillance policy makers have options, many of which are a lot less intrusive than the powers proposed by the CDB, and that civil society is open to meaningful engagement about surveillance laws in the digital age. It is written for a general audience by leading experts, academics and representatives of a number of civil society groups. The articles in this publication serve as an example of the sort of conversations that would be possible through a proper public debate about what information should be collected and who should have access to it. The opening two chapters put the CDB in historical and legal context. In chapter one, Duncan Campbell sets out the history of the tension between state surveillance and efforts to protect individuals’ privacy. He explains why the draft Communications Data Bill is “the latest chapter in the history of British state surveillance.” He also tells the parallel story of efforts to keep surveillance powers in check, including the 1972 Royal Commission on Privacy which “set out 10 principles of data protection that later underpinned data protection statutes in Europe and the UK.” In chapter two Angela Patrick, Director of Human Rights Policy at JUSTICE, gives an overview of the current settlement between the law, surveillance and the protection of privacy. She looks at how the draft Communications Data Bill could exacerbate problems with existing surveillance law, for example relating to oversight and complexity. She highlights that the overriding difference between the draft CDB and the existing law is the move “away from the presumption that for limited purposes, the State may access data already retained or reasonably obtainable by service providers...Instead, it creates a statutory basis for the generation, collection 4 and retention of data about us all.” In chapter three, Richard Clayton outlines in detail key surveillance technologies, showing what information about us is available and how the technology to gather and access it works. He outlines how the ‘filter’ – a key part of the CDB proposals – will work. By correlating information from multiple sources, he explains how the filter can answer complex queries. For example, he suggests that “the source of an embarrassing leak could be identified by cross-correlating records to pick out exactly who in Whitehall sent out an email whose reception by a journalist triggered an immediate call to the relevant newspaper editor.” Peter Sommer, in chapter four, argues that while surveillance law “is about balancing competing objectives”, a number factors inhibit “sensible and balanced discussion”. They include the pace of technological change, the demands of the law enforcement community, the level of technical and legal expertise required to understand how best to respond, and the fear of getting it wrong. Chapter five features contributions from a range of experts setting out how more privacy-friendly surveillance policy could work. For example, Caspar Bowden suggests how ‘data preservation’ policies could work to limit whose data is collected. Sam Smith from Privacy International argues that more could be done to help law enforcement make better use of what information is already available. Rachel Robinson from Liberty recommends lifting the ban on the use of intercept evidence in court, and Peter Sommer calls for a Royal Commission into surveillance laws in the digital age. In our conclusion we draw together these contributions and make some recommendations for future surveillance policy making. Notes 1. http://www.thesun.co.uk/sol/homepage/news/politics/4678082/Track-crime-on-net-or- well-see-more-people-die.html#ixzz2NL7B6fcr 2. See the reports of the Joint Committee on the draft Communications Data Bill (December 2012) http://www.publications.parliament.uk/pa/jt201213/jtselect/jtdraftcomuni/79/7902. htm and the report of the Intelligence and Security Committee (February 2013) http://isc. independent.gov.uk/committee-reports/special-reports 5 Duncan Campbell is a British freelance investigative journalist, author and television producer. Since 1975 he has specialised in the subjects of intelligence and security services, defence, policing, civil liberties and, latterly, computer forensics. 6 Chapter 1 The history of state surveillance Duncan Campbell The range and reach of surveillance legislation proposed or in place in the United Kingdom is far from novel in its roots or in its impact on the balance of power and rights between the subject and the state. The proposals in the Communications Data Bill (CDB), and the manner in which the new Bill has been introduced and managed, fall full square within long British historical precedents that position privacy rights as an irritant to be managed by a combination of concealment, secrecy, information management, and misinformation.